CVE-2026-90358

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) x86 trampoline. When processing 128-bit arguments, the system incorrectly calculates the required stack size for saving registers. This under-allocation leads to memory corruption by overwriting adjacent stack slots. A local attacker could potentially exploit this vulnerability to cause a denial of service or escalate privileges.

An x86 BPF trampoline stack overwrite can occur when a 128-bit scalar argument such as __int128 reaches the trampoline with arg_size 16. The previous register save area calculation only added extra slots for struct arguments, so save_args can write past the allocated save area and corrupt adjacent kernel stack slots. For the CVSS the PR:L is used because a local user or service with BPF trampoline loading privileges can trigger the vulnerable path, while ordinary remote packet traffic cannot trigger it directly. The issue is not network reachable. Impact is at least local denial of service via kernel crash and in the paranoid case may include confidentiality and integrity impact because this is a stack memory corruption primitive in generated kernel trampoline code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.